Add VNC console support for the Ironic driver

Ironic is adding support for VNC consoles tracked under the following
spec[1]. This change provides support for the Nova Ironic driver to
access the consoles created by this feature effort.

This supersedes an existing Nova spec[2] to add VNC console support to
the Ironic driver, so this change can be considered to implement this
spec also. This change can be merged independently of the Ironic work,
as the Ironic driver handles the VNC console not being available.

The pre-requesites for a graphical console being available for an Ironic
driver node is:

- Ironic is configured to enable graphical consoles
- The node ``console_interface`` is a graphical driver such as
  ``redfish-graphical`` or ``fake-graphical``
- ``nova-novncproxy`` can make network connections to the VNC servers
  which run adjacent to ``ironic-conductor``

The associated depends on adds the novnc validation check to the
baremetal basic ops, which is run in job
ironic-tempest-ipa-wholedisk-bios-agent_ipmitool-tinyipa.

In the support matrix console.vnc support is set to partial for ironic
due to the current lack of vencrypt support on the ironic side.

[1] https://specs.openstack.org/openstack/ironic-specs/specs/approved/graphical-console.html
[2] https://specs.openstack.org/openstack/nova-specs/specs/2023.1/approved/ironic-vnc-console.html

Related-Bug: 2086715
Implements: blueprint ironic-vnc-console
Change-Id: Iec26c67e29f91954eafc6a5a81086e36798d3f26
Signed-off-by: Steve Baker <sbaker@redhat.com>

doc/source/admin/configuration/hypervisor-ironic.rst

@@ -24,6 +24,13 @@ determine the root partition size when a partition image is used (see the
 :ironic-doc:`image documentation
 <install/configure-glance-images.html>`).
 
+VNC console support
+-------------------
+
+The nova noVNC VNC console service can connect to bare metal nodes when
+ironic has
+:ironic-doc:`Graphical console support<install/graphical-console.html>`
+enabled and configured.
 
 Configuration
 -------------

doc/source/admin/remote-console-access.rst

@@ -184,6 +184,12 @@ Replace ``IP_ADDRESS`` with the IP address from which the proxy is accessible
 by the outside world. For example, this may be the management interface IP
 address of the controller or the VIP.
 
+If using the ironic hypervisor driver, the following additional option is
+supported:
+
+- :oslo.config:option:`ironic.vnc_console_state_timeout`
+
+
 .. _vnc-security:
 
 VNC proxy security
@@ -271,6 +277,11 @@ set.
    [vnc]
    auth_schemes=vencrypt,none
 
+.. note::
+
+    Enabling ``vencrypt`` is not yet implemented for ironic, so this is not
+    yet supported for the ironic hypervisor driver.
+
 The :oslo.config:option:`vnc.auth_schemes` values should be listed in order
 of preference. If enabling VeNCrypt on an existing deployment which already has
 instances running, the noVNC proxy server must initially be allowed to use

doc/source/user/support-matrix.ini

@@ -1017,7 +1017,7 @@ driver.libvirt-kvm-s390x=missing
 driver.libvirt-qemu-x86=complete
 driver.libvirt-lxc=missing
 driver.vmware=complete
-driver.ironic=missing
+driver.ironic=partial
 driver.libvirt-vz-vm=complete
 driver.libvirt-vz-ct=complete
 driver.zvm=missing